From d9de2dde82860597a16b3ec9cf3dbabb451f3450 Mon Sep 17 00:00:00 2001
From: Jared Vititoe <jjvititoe1@gmail.com>
Date: Tue, 30 Jun 2026 20:49:52 -0400
Subject: [PATCH] ci: fix pip install under PEP 668
 (externally-managed-environment)

The Debian runner image marks its Python as externally managed, so
`pip3 install` fails with error: externally-managed-environment, breaking
the test/lint/security workflows at the install step (unrelated to the code
under test). Add --break-system-packages; the runner is ephemeral so a
system-wide install is fine.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .gitea/workflows/lint.yml     | 3 ++-
 .gitea/workflows/security.yml | 3 ++-
 .gitea/workflows/test.yml     | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml
index 942f6e3..a26c3a8 100644
--- a/.gitea/workflows/lint.yml
+++ b/.gitea/workflows/lint.yml
@@ -17,7 +17,8 @@ jobs:
         run: |
           apt-get update -qq
           apt-get install -y -qq python3 python3-pip
-          pip3 install flake8
+          # Debian's Python is externally managed (PEP 668); the runner is ephemeral.
+          pip3 install --break-system-packages flake8
 
       - name: Run flake8
         run: flake8 . --exclude=__pycache__,.git
diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index f941f11..43a2133 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -19,7 +19,8 @@ jobs:
         run: |
           apt-get update -qq
           apt-get install -y -qq python3 python3-pip
-          pip3 install bandit
+          # Debian's Python is externally managed (PEP 668); the runner is ephemeral.
+          pip3 install --break-system-packages bandit
 
       - name: Run bandit
         run: bandit -r . --exclude .git,__pycache__ -ll
diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index b335c68..5033b33 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -17,7 +17,8 @@ jobs:
         run: |
           apt-get update -qq
           apt-get install -y -qq python3 python3-pip python3-pytest python3-psutil python3-requests
-          pip3 install pytest-cov
+          # Debian's Python is externally managed (PEP 668); the runner is ephemeral.
+          pip3 install --break-system-packages pytest-cov
 
       - name: Run pytest with coverage
         run: python3 -m pytest tests/ -v --cov=. --cov-report=term-missing --cov-config=.coveragerc